Find process where a particular system call returns a particular error

Question

On OS X El Capitan, my log file system.log feels with hundreds of the following lines at times

03/07/2016 11:52:17.000 kernel[0]: hfs_clonefile: cluster_read failed - 34

but there is no indication of the process where this happens. Apart from that, Disk Utility could not find any fault with the file system. But I would still like to know what is going on and it seems to me that dtrace should be perfectly suited to find out that faulty process but I am stuck. I know of the function return probe but it seems to require the PID, e.g.

dtrace -n 'pidXXXX::hfs_clonefile:return { printf("ret: %d", arg1); }'

Is there a way to tell dtrace to probe all processes? And then how would I print the process name?

Answer 1

You can try something like this (I don't have access to an OS X machine to test it)

#!/usr/sbin/dtrace -s
# pragma D option quiet

fbt::hfs_clonefile:return
/ args[ 1 ] != 0 /
{
    printf( "\n========\nprocess: %s, pid: %d, ret value: %d\n", execname, pid, args[ 1 ] );
    /* get kernel and user-space stacks */
    stack( 20 );
    ustack( 20 );
}

For the fbt probes, args[ 1 ] is the value returned by the function.

The dTrace script will print out the process name, pid, and return value from hfs_clonefile() whenever the return value is not zero. It also adds the kernel and user space stack traces. That should be more than enough data for you to find the source of the errors.

Assuming it works on OS X, anyway.